Cryptographic processing apparatus, cryptographic processing method, and computer program

ABSTRACT

There is provided a highly secure cryptographic processing apparatus and method where an analysis difficulty is increased. In a Feistel type common key block encrypting process in which an SPN type F function having a nonlinear conversion section and a linear conversion section is repeatedly executed a plurality of rounds. The linear conversion process of an F function corresponding to each of the plurality of rounds is performed as a linear conversion process which employs an MDS (Maximum Distance Separable) matrix, and a linear conversion process is carried out which employs a different MDS matrix at least at each of consecutive odd number rounds and consecutive even number rounds. This structure makes it possible to increase the minimum number (a robustness index against a differential attack in common key block encryption) of the active S box in the entire encrypting function.

CROSS REFERENCES TO RELATED APPLICATIONS

The present invention claims priority to its priority document No.2003-339364 filed in the Japanese Patent Office on Sep. 30, 2003, theentire contents of which being incorporated by reference herein.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a cryptographic processing apparatusand a cryptographic processing method, and a computer program, moreparticularly to a cryptographic processing apparatus and a cryptographicprocessing method, and a computer program, which improve robustnessagainst a differential analysis known as a decryption process or anattack process.

2. Description of the Related Art

In these days, as network communications and electronic commerce havebeen developed, there is an important issue in ensuring security incommunications. One method for ensuring security is an encryptingtechnology. In fact, communications using a variety of encryptingmethods are carried out at present.

For example, a system is put into practical use where an encryptionprocessing module is embedded in a small apparatus, such as an IC card,data transmission and reception are carried out between the IC card anda reader/writer as a data read/write apparatus, and an authenticationprocess and encryption/decryption of transmission/reception data arecarried out.

There are various encryption processing algorithms, which can roughly beclassified into a public key cryptosystem where an encrypting key and adecryption key are set up as different keys, for example, a public keyand a secret key, and a common key cryptosystem where an encrypting keyand a decryption key are set up as common keys.

There are also various algorithms in the common key cryptosystem. One ofthem is a system where a plurality of keys are generated based on acommon key and it repeats and performs a data conversion process on ablock-by-block basis (64 bits, 128 bits, etc.) using the thus generatedplurality of keys. A typical system of the algorithms employing such akey generation system and a data conversion process is a common keyblock cryptosystem.

An algorithm of the typical common key block encryption may be, forexample, a DES (Data Encryption Standard) algorithm as U.S. standardencryption, which is used widely in various fields.

The algorithms for the common key block encryption represented by theDES are mainly divided into a round function section which performsconversion of input data, and a key schedule section which generates akey applied at each round of the round function (F function) section.The round key (subkey) applied at each round of the round functionsection is inputted into the key schedule section and generated based onone master key (main key), and applied in each round function section.

However, in such common key encryption process, there is a drawback thatthe key and the encryption algorithms may be leaked by way ofdecryption. As a typical method of the decryption or an attack method,the differential analysis (also referred to as the differentialdecryption system or a differential attack) is known, which analyzes anapplication key in each round function by analyzing a majority of inputdata (plain text) and their output data (cipher text) which have certaindifferences.

Ease of key analysis by way of decryption means that the security of theencryption processing is low. In a conventional DES algorithm, a process(conversion matrix) applied in a linear conversion section of the roundfunction (F function) section is the same at the round of each step,which makes it easy to perform the differential analysis. As a result,the key analysis can be performed without much difficulty, therebyposing the drawback in the application of such encryption process.

SUMMARY OF THE INVENTION

It is desirable to provide a cryptographic processing apparatus and acryptographic processing method, and a computer program, which realize acommon key block encryption algorithm highly robust against adifferential analysis.

Further it is desirable to provide, by carrying out a linear conversionprocess employing a conversion matrix different for each round, acryptographic processing apparatus and a cryptographic processingmethod, and a computer program, which realize the common key blockencryption algorithm highly robust against the differential analysis.

In view of the above-mentioned drawback, the present invention is made.

According to a first aspect of the present invention, there is provideda cryptographic processing apparatus which performs a Feistel typecommon key block encrypting process, and is configured such that an SPNtype F function having a nonlinear conversion section and a linearconversion section is repeatedly carried out a plurality of rounds; thelinear conversion section of the F function corresponding to each of theabove-mentioned plurality of rounds is adapted to perform a linearconversion process which employs an MDS (Maximum Distance Separable)matrix; and to perform a linear conversion process which employsdifferent MDS matrices at least at each of consecutive odd number roundsand consecutive even number rounds.

Further, in an embodiment of the cryptographic processing apparatus inaccordance with the present invention, the linear conversion section ofthe above-mentioned F function is adapted to perform a linear conversionprocess which employs different MDS matrices in all even number roundsand all odd number rounds, respectively.

Further, in an embodiment of the cryptographic processing apparatus inaccordance with the present invention, the algorithm of theabove-mentioned Feistel type common key block encrypting process is anencrypting algorithm with the number of rounds of 2r, and the linearconversion section of the above-mentioned F function is adapted toperform a linear conversion process which employs r types of differentMDS matrices one by one in all r even number rounds and all r odd numberrounds.

Further, in an embodiment of the cryptographic processing apparatus inaccordance with the present invention, the algorithm of theabove-mentioned Feistel type common key block encrypting process is theencrypting algorithm of the number of rounds 2r, and the linearconversion section of the above-mentioned F function is adapted toperform a linear conversion process in which q (where 2≦q<r) types ofdifferent MDS matrices are repeatedly employed one by one in all the reven number rounds and all the r odd number rounds.

Further, in an embodiment of the cryptographic processing apparatus inaccordance with the present invention, the linear conversion section ofthe above-mentioned F function is adapted to perform a linear conversionprocess with respect to an input of n bits outputted by respective mnonlinear conversion sections, or mn bits in total, and each ofdifferent plural MDS matrices applied in the linear conversion sectionof the above-mentioned F function is set up as an MDS matrix in such away that a matrix having m column vectors arbitrarily chosen from thecolumn vectors included in the above-mentioned plural MDS matrices islinearly independent.

Further, in an embodiment of the cryptographic processing apparatus inaccordance with the present invention, the linear conversion section ofthe above-mentioned F function is adapted to perform a linear conversionprocess with respect to the input of n bits outputted by respective mnonlinear conversion sections, or mn bits in total, and each of thedifferent plural MDS matrices applied in the linear conversion sectionof the above-mentioned F function is set up as an MDS matrix in such away that a matrix having m column vectors arbitrarily chosen from thecolumn vectors included in the above-mentioned plurality of MDS matricesis an MDS matrix.

Further, in an embodiment of the cryptographic processing apparatus inaccordance with the present invention, each of the different plural MDSmatrices applied in the linear conversion section of the above-mentionedF function has a matrix having the column vectors extracted from amatrix M′ having row vectors chosen from an MDS matrix M containing allthe components that included in the above-mentioned different MDSmatrix.

Further, in an embodiment of the cryptographic processing apparatus inaccordance with the present invention, each of the different plural MDSmatrices applied in the linear conversion section of the above-mentionedF function is an MDS matrix generated based on a Reed Solomon codegeneration matrix.

Further, according to a second aspect of the present invention, there isprovided a cryptographic processing method of performing a Feistel typecommon key block encrypting process wherein an SPN type F function ofperforming a nonlinear conversion process and a linear conversionprocess is repeatedly carried out a plurality of rounds. Further, thelinear conversion process of the F function corresponding to each of theabove-mentioned plurality of rounds performs a linear conversion processwhich employs the MDS (Maximum Distance Separable) matrix, and performsa linear conversion process which employ different MDS matrices at leastat each of the consecutive odd number rounds and the consecutive evennumber rounds.

Further, in an embodiment of the cryptographic processing method inaccordance with the present invention, the linear conversion process ofthe F function corresponding to each of the above-mentioned plurality ofrounds performs a linear conversion process in such a way that differentMDS matrices are employed in all the even number rounds and all the oddnumber rounds, respectively.

Further, in an embodiment of the cryptographic processing method inaccordance with the present invention, in the above-mentionedcryptographic processing method, the Feistel type common key blockencrypting process with the number of rounds 2r is performed; and thelinear conversion process of the F function corresponding to each of theabove-mentioned plurality of rounds performs a linear conversion processwhich employs r types of different MDS matrices one by one in all the reven number rounds and all the r odd number rounds.

Further, in an embodiment of the cryptographic processing method inaccordance with the present invention, as for above-mentionedcryptographic processing method, the Feistel type common key blockencrypting process with the number of rounds 2r is performed; and thelinear conversion process of F function corresponding to each of theabove-mentioned plurality of rounds performs a linear conversion processwhich employs q (where 2≦q<r) types of different MDS matrices one by onerepeatedly in all the r even number rounds and all the r odd numberrounds.

Further, in an embodiment of the cryptographic processing method inaccordance with the present invention, the linear conversion process ofthe F function corresponding to each of the above-mentioned plurality ofrounds is a linear conversion process for an input of n bits outputtedby each of m nonlinear conversion sections, or mn bits in total; andeach of the different plural MDS matrices applied in the linearconversion process of the F function corresponding to each of theabove-mentioned plurality of rounds is a MDS matrix wherein a matrixhaving m column vectors arbitrarily chosen from the column vectorsincluded in the above-mentioned plural MDS matrices is linearlyindependent.

Further, in an embodiment of the cryptographic processing method inaccordance with the present invention, the linear conversion process ofthe F function corresponding to each of the above-mentioned plurality ofrounds is a linear conversion process for an input of n bits outputtedby each of m nonlinear conversion sections, or mn bits in total; andeach of the different plural MDS matrices applied in the linearconversion process of the F function corresponding to each of theabove-mentioned plurality of rounds is a MDS matrix wherein a matrixhaving m column vectors arbitrarily chosen from the column vectorsincluded in the above-mentioned plural MDS matrices is an MDS matrix.

Further, in an embodiment of the cryptographic processing method inaccordance with the present invention, each of the different plural MDSmatrices applied in the linear conversion process of the F functioncorresponding to each of the above-mentioned plurality of rounds has amatrix having column vectors extracted from matrix M′ having row vectorschosen from a MDS matrix M containing all the components which includedin the above-mentioned plural MDS matrices.

Further, in an embodiment of the cryptographic processing method inaccordance with the present invention, each of the different plural MDSmatrices applied in the linear conversion section of the above-mentionedF function is a MDS matrix generated based on a Reed Solomon codegeneration matrix.

Further, according to a third aspect of the present invention, there isprovided a computer program which performs a Feistel type common keyblock encrypting process, wherein an SPN type F function for performinga nonlinear conversion process and a linear conversion process isrepeatedly carried out a plurality of rounds; and the linear conversionprocess of the F function corresponding to each of the plurality ofrounds performs a linear conversion process which employs the MDS(Maximum Distance Separable) matrix, and performs a linear conversionprocess which employ different MDS matrices at least at each of theconsecutive odd number rounds and the consecutive even number rounds.

In addition, the computer program in accordance with the presentinvention is a computer program which can be provided to a computersystem which can perform various program codes, for example, by way of astorage medium provided in a computer-readable form, a communicationmedia, a recording media, such as for example, a CD, an FD, an MO, etc.,or a communication media, such as a network. By providing such a programin a computer-readable form, a process according to the program isrealized on a computer system.

Other aspects, features, and advantages of the present invention will beapparent from the following detailed description based on examples andthe accompanying drawings of the present invention as described later.In addition, in this specification, by system we mean a logicalcollective structure of a plurality of apparatuses, which are not alwaysin the same casing.

According to the structure of the embodiments of the present invention,in the Feistel type common key block encrypting process in which the SPNtype F function having the nonlinear conversion section and the linearconversion section is repeatedly executed a plurality of rounds, thelinear conversion process of the F function corresponding to each of theplurality of rounds is performed as the linear conversion process whichemploys the MDS (Maximum Distance Separable) matrix, and the linearconversion process is carried out which employs the different MDS matrixat least at each of the consecutive odd number rounds and theconsecutive even number rounds, whereby the possibility of occurrence ofsimultaneous difference cancellations caused by an active S box isreduced or removed, and it becomes possible to increase the minimumnumber (a robustness index against the differential attack in the commonkey block encryption) of the active S box in the entire encryptingfunction. In other words, the number of the active S boxes at the timeof performing the differential analysis (differential attack) increases,and the difficulty of analyzing an encryption key etc. increases,whereby the robustness against the differential analysis becomes higherand highly secure encryption processing can be realized.

According to the structure of the embodiments of the present invention,in the Feistel type common key block encrypting process in which the SPNtype F function having the nonlinear conversion section and the linearconversion section is repeatedly executed the plurality of rounds, thelinear conversion process of the F function corresponding to each of theplurality of rounds is performed as the linear conversion process whichemploys the MDS (Maximum Distance Separable) matrix, the r different MDSmatrices, corresponding to the encrypting algorithm of the number ofrounds 2r, are generated so as to perform the linear conversion processwhich employs the r different MDS matrices in each of the even numberrounds and the odd number rounds, and confirm that the matrix having thecolumn vectors of the MDS matrices to be applied shows linearindependence or constitutes an MDS matrix, to thereby ensure that thesimultaneous difference cancellation caused by the active S box does notoccur and become possible to increase the minimum number (robustnessindex against the differential attack in the common key blockencryption) of the active S box in the entire encrypting function. Inother words, the number of the active S boxes at the time of performingthe differential analysis (differential attack) increases, so that thedifficulty of analyzing the encryption key etc., increases, whereby therobustness against the differential analysis is high so as to realizethe highly secure encryption processing.

According to the structure of the embodiments of the present invention,in the Feistel type common key block encrypting process in which the SPNtype F function having the nonlinear conversion section and the linearconversion section is repeatedly executed the plurality of rounds, thelinear conversion process of the F function corresponding to each of theplurality of rounds is performed as the linear conversion process whichemploys the MDS (Maximum Distance Separable) matrix. Corresponding tothe encrypting algorithm of the number of rounds 2r, q (integer, 2≦q<r)different MDS matrices are generated, and the linear conversion processis carried out where the q different MDS matrices are repeatedly appliedin each of the even number rounds and the odd number rounds, so thatapplication of the MDS matrices less than the number of rounds reducesthe possibility of occurrence of the simultaneous differencecancellation caused by the active S box, whereby it becomes possible toincrease the minimum number of the active S box in the entire encryptingfunction which is the robustness index against the differential attackin the common key block encryption. In other words, the number of theactive S boxes at the time of performing the differential analysis(differential attack) increases, so that the difficulty of analyzing theencryption key etc. increases, whereby the robustness against thedifferential analysis is high and the highly secure encryptionprocessing can be realized.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other objects, features and advantages of the presentinvention will become more apparent from the following description ofthe presently preferred exemplary embodiment of the invention taken inconjunction with the accompanying drawing, in which:

FIG. 1 is a diagram showing a structure of typical common key blockencryption with a Feistel structure;

FIG. 2 is a diagram for explaining a structure of an F function set upas a round function section in a linear conversion section;

FIG. 3 is a diagram showing an example of a square matrix applied to alinear conversion process;

FIG. 4 is a diagram for explaining how three steps of simultaneousdifference cancellation in the 128-bit block encryption where m=8 andn=8 are performed;

FIG. 5 is a diagram for explaining an example where linear conversion bymeans of a square matrix is performed in the linear conversion sectionof F function so as to generate an F function output difference ΔYi;

FIG. 6 is a diagram for explaining how five steps of simultaneousdifference cancellation in the 128-bit block encryption where m=8 andn=8 are performed;

FIG. 7 is a diagram for explaining the definition of the simultaneousdifference cancellation at an arbitrary step in the common key blockencryption;

FIG. 8 is a view showing an example of an MDS matrix;

FIG. 9 is a diagram for explaining a setup example of an MDS matrix as alinear conversion matrix of F function at each round in the common keyblock encrypting algorithm in accordance with the present invention;

FIG. 10 is a flow chart for explaining the MDS matrix setup processingsequence as a linear conversion matrix of F function at each round inthe common key block encrypting algorithm in accordance with anembodiment of the present invention;

FIG. 11 is a flow chart for explaining a generation method 1 ofgenerating an MDS matrix, which is a linear conversion matrix set as anF function at each round;

FIG. 12 is a flow chart for explaining a generation method 2 ofgenerating an MDS matrix, which is a linear conversion matrix set as anF function at each round;

FIG. 13 is a flow chart for explaining a generation method 3 ofgenerating an MDS matrix, which is a linear conversion matrix set as anF function at each round;

FIG. 14 is a chart for explaining a particular method of the generationmethod 3 of the MDS matrix, which is the linear conversion matrix set asthe F function at each round;

FIG. 15 is a diagram for explaining an setup example of the MDS matrixas the linear conversion matrix of the F function at each round in thecommon key block encrypting algorithm in accordance with an embodimentof the present invention;

FIG. 16 is a flow chart for explaining the MDS matrix setup processingsequence as the linear conversion matrix of the F function at each roundin the common key block encrypting algorithm in accordance with anembodiment of the present invention; and

FIG. 17 is a diagram showing an example of a structure of an IC moduleas a cryptographic processing apparatus that performs encrypting inaccordance with an embodiment of the present invention.

DETAILED DESCRIPTION OF THE EMBODIMENTS

A cryptographic processing apparatus and a cryptographic processingmethod, and a computer program in accordance with embodiments of thepresent invention will be described in detail hereinafter. Thedescription will be made in the order of the following:

1. Differential analysis process in common key block encryptionalgorithm

2. Encrypting algorithm based on an embodiment of the present invention

1. Difference Analysis Process in Common Key Block Encryption Algorithm

First, an outline of a differential analysis process in a common keyblock encryption algorithm typically represented by DES (Data EncryptionStandard) encryption will be described with using a generalized commonkey block encryption model.

The algorithm of the common key block encryption may be divided mainlyinto a round function section that performs conversion of input data anda key schedule section that generates a key applied at each round of theround function section. Based on one master key (main key), a key (subkey) to be applied at each round of the round function section isgenerated by inputting into the key schedule section and applied in eachround function section. A typical system of this common key cryptosystemis DES (Data Encryption Standard) that is used as a U.S. federalstandard encryption system.

A structure of the typical common key block encryption called a Feistelstructure will be described with reference to FIG. 1.

The Feistel structure has a structure to convert a plain text into acipher text by way of simple repetition of a conversion function. Alength of the plain text is assumed to be 2 mn bits where both m and nare integers. At first, the plain text of 2 mn bits is divided into twoinput data P_(L) (Plain-Left) 101 and P_(R) (Plain-Right) 102 of mnbits, and provided as input values.

The Feistel structure is expressed by repetition of a basic structurecalled a round function. A data conversion function included in eachround is called an F function 120. In a structure of FIG. 1, the Ffunction (round function) 120 shows an example of a structure where itis repeated for r steps.

For example, at the first round, an input data X of mn bits and a roundkey K₁ 103 of mn bits inputted from the key generation section (notshown) are inputted into the F function 120, and data Y of mn bits isoutputted after processing data conversion in the F function 120. Theoutput and input data (input data P_(L) in the case of the first step)from the preceding step on the other side are subjected to anexclusive-OR operation in an exclusive-OR section 104, and an operationresult of mn bits is outputted to the following round function. Thisprocess, that is, an encrypting process where F function is repeatedlyapplied a predetermined number of rounds (r) is completed so as tooutput division data C_(L) (Cipher-Left) and C_(R) (Cipher-Right) of thecipher text. According to the above structure, a decryption process ofthe Feistel structure may only be carried out by reversing the order ofinserting the round key, so that it is understood that it is notnecessary to construct an inverse function.

A structure of the F function 120 set up as a function of each roundwill be described with reference to FIG. 2. FIG. 2( a) is a diagramshowing the input and output to the F function 120 in one round. FIG. 2(b) is a diagram showing a particular structure of the F function 120. Asshown in FIG. 2( b) the F function 120 has a so-called SPN typestructure where a nonlinear conversion layer and a linear conversionlayer are connected together.

As shown in FIG. 2( b) the SPN type F function 120 has a plurality of Sboxes (S-box) 121 which perform the nonlinear conversion process. Aninput value X of mn bits from the preceding step of the round functionsection and a round key Ki inputted from the key schedule section aresubjected to the exclusive-OR operation. The resulting output isinputted into the plurality (m pieces) of S boxes 121 where thenonlinear conversion process is carried out for every n bits. In each ofthe S boxes the nonlinear conversion process which employs a conversiontable, for example, is carried out.

An output value Z, of mn bits, which is the output data from the S boxes121 is inputted into a linear conversion section 122 for performing thelinear conversion process, where the linear conversion process, such asfor example a process of exchanging bit positions, is performed so as tooutput an output value Y of mn bits. This output value Y and the inputdata from the preceding step are subjected to the exclusive-ORoperation, which is rendered to be an input value to the F function ofthe next round.

The F function 120 as shown in FIG. 2 has an input/output bit length ofm×n bits (where m, n are integers). The nonlinear conversion layer has mpieces of S boxes 121 arranged in parallel as the nonlinear conversionlayer, each having an n-bits input/output. The linear conversion section122 as the linear conversion layer performs the linear conversionprocess based on an m-th square matrix which has, as components,elements in an extension field GF (2^(n)) of 2 defined by an n-thirreducible polynomial.

An example of the square matrix applied to the linear conversion processin the linear conversion section 122 is shown in FIG. 3. A square matrix125 as shown in FIG. 3 is an example where n=8 and m=8. A linearconversion is performed by way of an operation which employs thepredetermined square matrix 125 with respect to m n-bit data Z[1], Z[2],. . . , Z[m] outputted from the nonlinear conversion section (S boxes121), and Y[1], Y[2], . . . , Y[m] are determined as the F function(round function) output. At this time, however, a linear operation withrespect to the components of a matrix of each data is performed in thepredetermined extension field GF (2^(n)) of 2.

In a conventional Feistel type encryption, since the same linearconversion layer as the F function is used for all steps, there is adrawback such that a plurality of differences will cancel one anothersimultaneously when the differences propagate. As described in thecolumn of the background art, as a typical method of the decryptionmethods, the differential analysis (or the differential decryptionmethod) is known which analyzes the application key in each roundfunction by analyzing the majority of the input data (plain text) andtheir output data (cipher text), which have certain differences. In thecommon key block encryption, such as the conventional DES encryptionalgorithm, the process (conversion matrix) applied in the linearconversion section 122 of the F function 120 section is set as equal inthe round of each step, which makes it easy to perform the differentialanalysis, whereby making the key analysis easier.

An example in which a plurality of differences cancel one anothersimultaneously as the differences propagate will be described withreference to FIG. 4. In addition, in this specification, the Δ (delta)symbol will be used when expressing a difference.

FIG. 4 is a diagram for explaining how three steps of simultaneousdifference cancellations in 128-bit block encryption where m=8 and n=8are executed. It is assumed that, in the diagram, a 64-bit data isdivided per byte so as to be expressed as a vector, and that eachelement is written in hexadecimal notation.

Such simultaneous difference cancellations in the F function having athree-step structure take place, for example, based on a settingmechanism of the following data statuses 1-4. The data status generatedby a mechanism as described below is a data status which can begenerated by setting up a plurality of differential input data. It maytake place when analyzing a key (round key) in a so-called differentialanalysis.

(Status 1)

It is assumed that a left half of an input difference to i round is aninput difference (ΔXi−1=(00, 00, 00, 00, 00, 00, 00, 00)) which is allzeros, and that an input difference of a right half is an inputdifference (ΔXi=(34, 00, 00, 00, 00, 00, 00, 00)) which is all zerosexcept for an input to only one S-box. This data status means thatsetting up a plurality of differential input data allows such a datastatus to be acquired at i round.

In addition, the respective eight elements in ΔXi=(34, 00, 00, 00, 00,00, 00, 00) correspond to the input differences with respect to m Sboxes (m=8) arranged in the F function. The difference (34) is inputtedinto the first S box ((S1) in FIG. 4), and (00) is the input differencewith respect to the second through eighth S boxes.

In addition, an output difference of an S box having an input differenceof zero (00) is zero (00). As far as differential data are concerned,the S box having the input difference of zero (00) does not perform anyoperation, so that it is not active and called as a non-active S box. Onthe other hand, an S box having a non-zero input difference (difference:34 as in the example of FIG. 4) generates as an output difference bycausing a nonlinear conversion corresponding to the input difference ofnon-zero. Accordingly, it is called an active S box (Active S-box).

In the example of FIG. 4 the output difference (b7) is generated from anactive S box (S1) which inputs the input difference (34) of non-zero,other non-active S boxes S2-S8 generate an output difference (00) basedon an input difference (00) of zero, which is considered to be thedifferential input of the linear conversion section.

(Status 2)

After an output difference from an S box (hereinafter referred to asActive S-box) having the input difference (difference: 34 as in the caseof FIG. 4) of the non-zero to i round is diffused in the linearconversion layer, it is outputted from the F function (outputvalue=ΔYi), and becomes an input difference ΔXi+1 to the next round.

As for the linear conversion in the example of FIG. 4, the linearconversion by means of the certain specific square matrix 125 which iscommon in the F function of each round and which is shown, for examplein FIG. 5 is performed, and ΔYi=(98, c4, b4, d3, ac, 72, 0f, 32) at iround is outputted as the F function output difference. As can be seenfrom the linear conversion structure as shown in FIG. 5, the outputdifference ΔYi=(98, c4, b4, d3, ac, 72, 0f, 32) is determined as a valuedepending only on an output factor Z[1]=b7 which is from the one activeS box (S1).

ΔYi=(98, c4, b4, d3, ac, 72, 0f, 32), which serves as the F functionoutput difference at this i round, and the input difference (ΔXi−1=(00,00, 00, 00, 00, 00, 00, 00) that is all zeros are subjected to theexclusive-OR (XOR) operation in the exclusive-OR section 131 as shown inFIG. 4. The operation result becomes an input difference ΔXi+1 to thenext round (i+1).

The exclusive-OR (XOR) operation between ΔYi=(98, c4, b4, d3, ac, 72,0f, 32) as the F function output difference at i round and the inputdifference ΔXi−1=(00, 00, 00, 00, 00, 00, 00, 00) which is all zerosresults in ΔYi. Accordingly, the ΔYi becomes the input differenceΔXi+1=ΔYi=(98, c4, b4, d3, ac, 72, 0f, 32) to the next round (i+1).

(Status 3)

An output difference ΔYi+1 from the F function at i+1 round has anon-zero value only in the position of the active S-box at i round. Thisdata status means that setting up a plurality of differential input dataallows such a data status to be acquired.

In other words, it is ΔYi+1=(ad, 00, 00, 00, 00, 00, 00, 00). As with iround, it has a non-zero value only in the position (the first S box(S1)) of S-box having a non-zero differential value (difference: 34 inthe case of FIG. 4). It is clearly ad≠00.

(Status 4)

This data status is achieved when the output difference of the active Sbox (Active S-box) (S1) at i+2 round is in agreement with the outputdifference of the active S box (Active S-box) (S1) at i round, or asshown in FIG. 4, the output difference of the active S box (S1) at i+2round becomes b7, and therefore is in agreement with the outputdifference (b7) of the active S box (S1) at i round. This data statusmeans that setting up a plurality of differential input data allows sucha data status to be acquired.

If such a data status occurs, an output difference ΔYi+2=(98, c4, b4,d3, ac, 72, 0f, 32) of the F function at i+2 round will be in agreementwith output difference ΔYi=(98, c4, b4, d3, ac, 72, 0f, 32) of the Ffunction at i round, or two rounds before i+2 round.

As a result, in the exclusive-OR section 133, ΔXi+1=ΔYi=(98, c4, b4, d3,ac, 72, 0f, 32) and ΔYi+2=(98, c4, b4, d3, ac, 72, 0f, 32) of the samevalues are subjected to the exclusive-OR operation, and a value havingonly zeros is outputted as an exclusive-OR operation result.

As a result, it becomes a left input difference ΔXi+3=(00, 00, 00, 00,00, 00, 00, 00) from the preceding step (i+2 round) of the outputdifference to the next step (round i+3).

The left input ΔXi+3=(00, 00, 00, 00, 00, 00, 00, 00) to this round i+3has only zeros, similar to the left input ΔXi−1=(00, 00, 00, 00, 00, 00,00, 00) to round i. A process similar to those at rounds i through i+2may be repeated at a round after the round i+3.

As a result, a drawback arises such that the number of active S boxesdoes not increase even the number of rounds increase, and the robustnessagainst the differential attack does not increase considerably.

In the common key block encryption, as a robustness index against thedifferential attack, the minimum number of the active S boxes in theentire encrypting function is known. It is considered that the greaterthe minimum number of the number of active S boxes is, the higher therobustness against the differential attack is.

As described above, the differential analysis (differential attack) is amethod in which a majority of input data (plain texts) and their outputdata (cipher texts) having certain differences are set up, whoserelationships are analyzed in order to analyze an application key ineach round function. In this differential analysis, if the number ofactive S boxes can be decreased, the analysis may become easier and thenumber of analysis processes can be reduced.

In the above-mentioned example with reference to FIG. 4, it is shownthat the way in which a pattern where only the first S box (S1) is anactive S box is generated. However, as for other S boxes (S2-S8), it ispossible to set up any one of the S boxes as the active S box by settingup the input data of the differential analysis. By performing such adifferential analysis process, it becomes possible to analyze thenonlinear conversion process of each of the S boxes and further toanalyze the round key inputted to the F function.

In order to increase the robustness against such a differentialanalysis, it is necessary to maintain the number of active S boxes to belarge, that is, the minimum number of the active S boxes is required tobe large.

In the example as described with reference to FIG. 4, in view of the Ffunction which performs input from the right into the left, in otherwords, considering only the i-th round and the i+2-th round as roundsfor active S box calculation processing, the number of active S boxes isonly two. Although the F function which performs input from the leftinto the right, that is, the number of active S boxes is eight at thei+1-th round, the number of active S boxes at the i+3-th round is set tozero by simultaneous difference cancellations, and the analysis processof the nonlinear conversion process of each of the S boxes by way ofdifferential analysis becomes easy.

As for the common key block encryption algorithm as shown in FIG. 4, thelinear conversion matrix applied in the linear conversion section ineach round is the same. This structure allows a possibility that onlytwo active S boxes especially in the F function which performs the inputfrom the right into the left may generate the simultaneous differencecancellations. Therefore, there is a drawback that the minimum number ofthe active S boxes does not sufficiently increase even the number ofrounds increase, and the robustness against the differential attack doesnot increase considerably.

Next, similarly, in the structure in which the same linear conversionmatrix is used for the F function of every step (round), a simultaneousdifference cancellations generating mechanism over five rounds will bedescribed with reference to FIG. 6.

FIG. 6 is a diagram for explaining how five steps of the simultaneousdifference cancellations in the 128-bit block encryption where m=8 andn=8 are performed. It is assumed that, in the figure, the 64-bit data isdivided per byte so as to be expressed as a vector, and that eachelement is written in hexadecimal notation.

Such simultaneous difference cancellations in the F function having afive-step structure take place, for example, based on a settingmechanism of the following data statuses 1-7. The data status generatedby a mechanism as described below is a data status which can begenerated by setting up a plurality of differential input data. It maytake place when analyzing a key (round key) in the so-calleddifferential analysis.

(Status 1)

It is assumed that a left half of an input difference to i round is aninput difference (ΔXi−1=(00, 00, 00, 00, 00, 00, 00, 00)) which is allzeros, and that an input difference of a right half is an inputdifference (ΔXi=(34, 00, 00, 00, 00, 00, 00, 00)) which is all zerosexcept for an input to only one S-box. This data status means thatsetting up a plurality of differential input data allows such a datastatus to be acquired at i round.

In addition, the respective eight elements in ΔXi=(34, 00, 00, 00, 00,00, 00, 00) correspond to the input differences with regard to mrespective S boxes (m=8) arranged in the F function. (34) is inputtedinto the first S box ((S1) in FIG. 6), and (00) is the input differencewith respect to the second through eighth S boxes.

In addition, as described above, the output difference of the S boxhaving the input difference of zero (00) is zero (00). As far asdifference data are concerned, the S box having the input difference ofzero (00) does not perform any operation, so that it is not active andcalled as the non-active S box. On the other hand, the S box (S1) havingthe non-zero input difference (difference: 34 as in the example of FIG.6) causes the nonlinear conversion effect corresponding to the inputdifference of non-zero as the output difference, which is the active Sbox (Active S-box).

In the example of FIG. 6 the output difference (b7) of one active S box(S1) which inputs the input difference (34) of non-zero is generated,other non-active S boxes S2-S8 generate the output difference (00) basedon the input difference (00) of zero, which is considered to be thedifferential input of the linear conversion section.

(Status 2)

After an output difference from an S box (hereinafter referred to asActive S-box) having the input difference (difference: 34 as in the caseof FIG. 4) of the non-zero to i round is diffused in the linearconversion layer, it is outputted from the F function (output value=ΔYi)and becomes an input difference ΔXi+1 to the next round.

In the example of FIG. 6 the linear conversion by a certain specificsquare matrix 125 common in each round as shown, for example, in FIG. 5is carried out, and ΔYi=(98, c4, b4, d3, ac, 72, 0f, 32) is outputted asthe F function output difference at i round.

The ΔYi=(98, c4, b4, d3, ac, 72, 0f, 32) that serves as the F functionoutput difference at i round and the input difference (ΔXi−1=(00, 00,00, 00, 00, 00, 00, 00) which is all zeros are subjected to theexclusive-OR (XOR) operation in an exclusive-OR section 141 as shown inFIG. 6. The operation result becomes the input difference ΔXi+1 to thenext round (i+1).

The exclusive-OR (XOR) operation between ΔYi=(98, c4, b4, d3, ac, 72,0f, 32) that serves as the F function output difference at i round andthe input difference ΔXi−1=(00, 00, 00, 00, 00, 00, 00, 00) which is allzeros results in ΔYi. Accordingly, the ΔYi becomes the input differenceΔXi+1=ΔYi=(98, c4, b4, d3, ac, 72, 0f, 32) to the next round (i+1).

(Status 3)

An output difference ΔYi+1 from the F function at i+1 round has anon-zero value only in the position of the active S-box at i round. Thisdata status means that setting up a plurality of differential input dataallows such a data status to be acquired.

In other words, ΔYi+1=(34, 00, 00, 00, 00, 00, 00, 00). As with i round,it has a non-zero value only in the position (the first S box (S1)) ofS-box having a non-zero difference value (difference: 34 in the case ofFIG. 6).

(Status 4)

The input to the F function at i+2 round is the resulting exclusive-ORoperation between ΔXi=(34, 00, 00, 00, 00, 00, 00, 00) and ΔYi+1=(34,00, 00, 00, 00, 00, 00, 00) in the exclusive-OR section 142. In otherwords, it is the resulting exclusive-OR operation between the same data,and it is ΔXi+2=(00, 00, 00, 00, 00, 00, 00, 00) which is an all-zeroinput. As a result, the output difference from the F function at i+2round becomes also an output difference, ΔYi+2=(00, 00, 00, 00, 00, 00,00, 00) which is all zeros.

(Status 5)

The input to the F function at i+3 round is the resulting exclusive-ORoperation between ΔXi+1=(98, c4, b4, d3, ac, 72, 0f, 32) and the Ffunction output difference at i+2 round ΔYi+2=(00, 00, 00, 00, 00, 00,00, 00) which is all zeros in the exclusive-OR section 143, whichbecomes the input ΔXi+3=ΔXi+1=(98, c4, b4, d3, ac, 72, 0f, 32) to the Ffunction of i+3 round.

(Status 6)

The F function output difference at i+3 round becomes ΔYi+3=(43, 00, 00,00, 00, 00, 00, 00), which is subjected to the exclusive-OR operationwith ΔXi+2=(00, 00, 00, 00, 00, 00, 00, 00) which is all zeros in theexclusive-OR section 144. The resulting ΔXi+4=ΔYi+3=(43, 00, 00, 00, 00,00, 00, 00) becomes the F function input difference at i+4 round.

(Status 7)

When the output difference of the active S box (Active S-box) (S1) ati+4 round is in agreement with the output difference of the active S box(Active S-box) (S1) at i round, or as shown in FIG. 6, the outputdifference of the active S box (S1) at i+4 round becomes b7, so that itis in agreement with the output difference (b7) of the active S box (S1)at i round. This data status means that setting up a plurality ofdifferential input data allows such a data status to be acquired.

If this data status occurs, an output difference ΔYi+4=(98, c4, b4, d3,ac, 72, Of, 32) of the F function at i+4 round will be in agreement withthe output difference ΔXi+3=(98, c4, b4, d3, ac, 72, 0f, 32) of theexclusive-OR section 143 at i+2 round, or two rounds before i+4 round.

As a result, in the exclusive-OR section 145 an exclusive-OR operationfor the same values is performed, which are ΔXi+3=(98, c4, b4, d3, ac,72, 0f, 32) and ΔYi+4=(98, c4, b4, d3, ac, 72, 0f, 32), and a valuehaving only zeros is outputted as an exclusive-OR operation result.

As a result, the input difference to the next step (round i+5) is set upas ΔXi+5=(00, 00, 00, 00, 00, 00, 00, 00).

The left input to this round i+5, ΔXi+5=(00, 00, 00, 00, 00, 00, 00, 00)is all zeros similarly as in the left input to round i, ΔXi−1=(00, 00,00, 00, 00, 00, 00, 00). There is a possibility that, at rounds afterround i+5, a process similar to that at rounds i through i+4 may berepeated.

As a result, a drawback arises such that the number of active S boxesdoes not increase as the number of rounds increase, and the robustnessagainst the differential attack does not increase considerably.

As described above, the differential analysis (differential attack) isthe method in which a majority of input data (plain texts) and theiroutput data (cipher texts) having certain differences are set up, whoserelationships are analyzed in order to analyze an application key ineach round function. In this differential analysis, if the number ofactive S boxes can be decreased, the analysis may become easy and thenumber of analysis processes can be reduced.

In the example as described with reference to FIG. 6, in view of the Ffunction which performs input from the right into the left, in otherwords, considering only the i-th round, the i+2-th round, and the i+4-thround as rounds for active S box calculation processing, the number ofactive S boxes is only two in total where the i-th round=1, the i+2-thround=0, the i+4-th round=1. Although the F function which performsinput from the left into the right, that is, the number of active Sboxes is eight at the i+1-th round and the i+3-rd round, the number ofactive S boxes at the i+5-th round is set to zero by simultaneousdifference cancellations. Accordingly, the analysis process of thenonlinear conversion process of each of the S boxes by way ofdifferential analysis and the analysis process of an input round keywith respect to the F function become relatively easy.

In the example with reference to FIG. 6, it is shown the way in which apattern where only the first S box (S1) is an active S box is generated.However, as for other S boxes (S2-S8) it is possible to set up any oneof the S boxes as the active S box by setting up the input data of thedifferential analysis. By performing such a differential analysisprocess, it becomes possible to analyze the nonlinear conversion processof each of the S boxes and further to analyze the round key inputted tothe F function.

The examples of the simultaneous difference cancellations are describedin the cases of three and five rounds with reference to FIG. 4 and FIG.6. If the simultaneous difference cancellation is defined bygeneralizing it to an arbitrary number of rounds, the definition will beas follows. With reference to FIG. 7, the definition of the simultaneousdifference cancellation at the arbitrary number of rounds will bedescribed. In addition, FIG. 7 shows the rounds (i, i+2, i+4, . . . ,i+2j) in every other one of Feistel structure which performs the commonkey block encryption of the Feistel structure.

Definition

By “simultaneous difference cancellation”, we mean that in a processwhere half (P_(L) or P_(R)) the input difference at the round i of theFeistel structure is zero (ΔXi=(00, 00, 00, 00, 00, 00, 00, 00) in FIG.7) with which the output difference of the F function at i+2j round(j=0, 1, 2, . . . ) is operated in the exclusive-OR section, theexclusive-OR operation result becomes 0 (ΔXi+2j+1=(00, 00, 00, 00, 00,00, 00, 00) in FIG. 7) at a certain round i+2k.

At that time, it is assumed that the active S box (Active S-box) whichexists in the F function at i, i+2, i+4, . . . , i+2k round is called“active S box having generated simultaneous difference cancellation”. Ifthe number of non-zero elements of vector A is defined as Hamming weighthw(A), the number a of an active S boxes which generate the simultaneousdifference cancellation can be expressed as the following equation:

$a = {\sum\limits_{j = 0}^{k}{{hw}\left( {\Delta\; X_{i + {2j}}} \right)}}$

In both examples of the above-mentioned round three and round five, thenumber of active S boxes which have generated simultaneous differencecancellation is two, or a=2.

As described above, a robustness index against the differential attackin the common key block encryption is the minimum number of the active Sbox in the entire encrypting function. It is considered that the greaterthe minimum number of the number of active S boxes is, the higher therobustness against the differential attack is.

However, in the structure where the same linear conversion matrix isused for the F function of all steps as in the DES algorithm, there is apossibility that only two active S boxes may generate the simultaneousdifference cancellation as described above with reference to FIG. 4,FIG. 6. Because of such nature, the minimum number of the active S boxdoes not sufficiently increase as the number of rounds increase.Accordingly, there is a drawback that the robustness against thedifferential attack does not increase considerably.

2. Encrypting Algorithm Based on an Embodiment of the Present Invention

Now, a common key block encrypting algorithm in accordance with anembodiment of the present invention will be described. The algorithmrealizes a structure in which the simultaneous difference cancellationbased on several active S boxes does not or is not likely to take place,thereby improving the robustness against the differential attack, orincreasing the difficulty of key analysis and its security.

A feature of the encrypting algorithm in accordance with the presentembodiment is that, unlike the conventional DES algorithm, it does notemploy a structure where a common process (conversion matrix) is appliedto the linear conversion section arranged for the F function at eachround. The algorithm according to the present embodiment employs thestructure in which a plurality of different MDS (Maximum DistanceSeparable) matrices are set up. In particular, it has a structure inwhich the linear conversion process is carried out while employingdifferent MDS matrices at least at each of the consecutive odd numberrounds and the consecutive even number rounds.

The encrypting algorithm in accordance with the present embodimentutilizes a property of the MDS (Maximum Distance Separable) matrix andrealizes a structure where the simultaneous difference cancellationbased on several active S boxes does not or is not likely take place. Itincreases the minimum number of the active S box and provides the commonkey block encrypting which is more robust against the differentialattack.

The encrypting algorithm of the present embodiment employs the structureof a typical common key block encryption called the Feistel structurehaving a SPN type F function as described with reference to FIG. 1, FIG.2. In other words, the encrypting algorithm employs a structure wherethe SPN type F function having a nonlinear conversion section and alinear conversion section is simply repeated over a plurality of rounds,and a plain text is converted to a cipher text, or alternatively acipher text is converted to a plain text.

For example, it is assumed that the length of a plain text is 2 mn bits(where both m and n are integers). The plain text of 2 mn bits isdivided into two data P_(L) (Plain-Left) and P_(R) (Plain-Right) eachhaving mn bits, and is provided as input values for the F function to beperformed at each round. As described above with reference to FIG. 2,the F function is an F function having the nonlinear conversion sectionhaving the S boxes and the SPN type to which the linear conversionsection is connected.

In the structure of the present embodiment, as for the matrix for thelinear conversion process applied in the linear conversion section inthe F function, a matrix chosen from a plurality of different MDS(Maximum Distance Separable) matrices is set up as a matrix which isapplied in the linear conversion section of the F function at eachround. In particular, a different MDS matrix is applied at least at eachof the consecutive odd number rounds and the consecutive even numberrounds.

The MDS matrix will be described. By MDS matrix, we mean a matrix whichsatisfies the following conditions of (a) and (b):

(a) It is a square matrix.

(b) No determinant of any submatrix included in the matrix is zero. Inother words, det(submatrix)≠0

A matrix which satisfies the above conditions (a) and (b) is called anMDS matrix. An example of an MDS matrix is shown in FIG. 8, in which aninput/output bit length with respect to the F function performed at eachround of the common key block encryption is m×n bits (m, n: integers),the nonlinear conversion section included in the F function isconstituted by m S boxes each having the n bits input/output, when thelinear conversion section performs the linear conversion process basedon an m-th square matrix which has, as components, elements in anextension field GF (2^(n)) of 2 defined by an n-th irreduciblepolynomial. The example of the MDS matrix as shown in FIG. 8 is anexample of the MDS matrix where n=8 and m=8.

When it is assumed that the number of non-zero elements of the vector Ais the Hamming weight hw(A), M is the m-th MDS matrix, and x is an inputvector to the MDS matrix M, the MDS matrix which satisfies the above (a)and (b) satisfies the following inequality (equation 1):hw(x)+hw(Mx)≧m+1  (Equation 1)

The above-mentioned Equation 1 means that the sum of the number of thenon-zero elements hw(x) of the input data x to be subjected to thelinear conversion by means of the MDS matrix (M) and the number of thenon-zero elements hw(Mx) of the output data Mx subjected to the linearconversion by means of the MDS matrix (M) is greater than the order m ofthe MDS matrix.

By the way, the name of MDS matrix is decided from the fact that theright half of a canonical form of the generated matrix of MDS-code(Maximum Distance Separable Code) satisfies the above-mentionedconditions.

Even in a conventional structure of including a matrix in every Ffunction, it is known that the minimum number of the active S boxes canbe held at a relatively high level by using the MDS matrix for thelinear conversion matrix, than in the case where the matrix which is notan MDS matrix is used.

The present invention utilizes a matrix that satisfies the conditions ofthe MDS matrix for the F function at each round, and further provides amethod of setting up a different matrix for every round. In particular,different MDS matrices are applied at least at each of the consecutiveodd number rounds and the consecutive even number rounds.

As for the Feistel type common key block encryption where the number ofsteps (the number of rounds) is 2r (where r is an integer), a pluralityof examples of structures where the robustness against the differentialattack is increased will be described hereinafter.

In addition, in the following description, it is assumed that MLTjrepresents the linear conversion matrix applied in the linear conversionsection in the j-th step of F function of the Feistel type common keyblock encrypting process structure having the number of steps (thenumber of rounds) of 2r.

SETUP EXAMPLE 1 Linear Conversion Matrix MLTj

In the Setup Example 1 of a linear conversion matrix MLTj, correspondingto the Feistel type common key block encrypting process structure havingthe number of steps (the number of rounds) of 2r, r MDS matrices aregenerated in such a way that all the square matrices applied in the rlinear conversion sections of the F function at even number rounds areset up as different MDS matrices, and also all the square matricesapplied in the r linear conversion sections of the F function at oddnumber rounds are set up as different MDS matrices.

An example of a structure which employs this setup example is shown inFIG. 9. FIG. 9 shows the MDS matrices (L1, L2 . . . L6) set in thelinear conversion section of the F function section at each round, whenthe Feistel type common key block encrypting process is arranged suchthat the number of steps (the number of rounds) is expressed as 2r=12,or r=6. Although not shown clearly in the figure, it is assumed that asub key Ki inputted from the key scheduling section is inputted at eachround.

The structure of FIG. 9 is a structure where a plain text of 2 mn bitsis divided into two data P_(L) (Plain-Left) and P_(R) (Plain-Right) ofmn bits, and provided as input values for the F function to be performedat each round. As described above with reference to FIG. 2, any of the Ffunction 301 at first round and the F functions at other rounds is an Ffunction having the nonlinear conversion section constituted by the Sboxes and the SPN type to which the linear conversion section isconnected.

In FIG. 9, reference symbol Ln as shown in each F function denotes theMDS matrix 302. In other words, L1, L2, . . . , L6 respectively indicatesix different types of MDS matrices, or indicate the MDS matricesapplied to the linear conversion processes in the linear conversionsections of the respective F functions.

A processing sequence of the Setup Example 1 of the linear conversionmatrix MLTj will be described with reference to FIG. 10.

[Step S11]

The m-th MDS matrices L1, L2, . . . , Lr on r GF's (2^(n)) aregenerated.

A processing sequence of generating the m-th MDS matrices L1, L2, . . ., Lr on r GF's (2^(n)) (MDS matrix generation method 1) will bedescribed with reference to FIG. 11.

MDS Matrix Generation Method 1

[Step S101]

Input: Assuming that the required number of MDS's: x, the expansionorder: n, and size of a matrix: m, x pieces of m-th MDS matrices L1, L2,. . . , Lx are generated on GF (2^(n)) at random.

[Step S102]

When m arbitrary columns are taken out from xm columns contained in xpieces of m-th MDS matrices L1, L2, . . . , Lx, they are checked to seewhether they are linearly independent. If they pass the check, theprocess goes to Step S103, or otherwise returns to Step S101.

[Step S103]

The x pieces of m-th MDS matrices L1, L2, . . . , Lx are outputted asthe MDS matrices applied to the Feistel type common key block encryptionhaving the number of rounds of 2x.

By way of above processes, the x pieces of m-th MDS matrices L1, L2, . .. , Lx are generated. In this example, x=r.

Returning to FIG. 10, the description of the processing sequence of theSetup Example 1 for the linear conversion matrix MLTj will be continued.In Step S11, if the m-th MDS matrices L1, L2, . . . , Lr on r GF's(2^(n)) are generated by way of generation processing of the MDSmatrices as described with reference to FIG. 11, then the following MDSmatrices setting processes are performed.

[Step S12]

Li is set as the linear conversion matrix MLT_(2i−1) of 2i−1 (1≦i≦r)step.

[Step S13]

MLT_(2r−2i+1) is set as the linear conversion matrix MLT_(2i) of 2i(1≦i≦r) step.

For example, in the case of 12 steps (r=6) as shown in FIG. 9 setupsare:

MLT1=L1, MLT2=L6

MLT3=L2, MLT4=L5

MLT5=L3, MLT6=L4

MLT7=L4, MLT8=L3

MLT9=L5, MLT10=L2

MLT11=L6, MLT12=L1

In other words, in the Setup Example 1 of the linear conversion matrixMLTj, corresponding to the Feistel type common key block encryptingprocess structure having the number of steps (the number of rounds) of2r, r MDS matrices are generated, so that all the square matricesapplied in the r linear conversion sections of the F function at theeven number rounds are set up as different MDS matrices, and also allthe square matrices applied in the r linear conversion sections of the Ffunctions at the odd number rounds are set up as different MDS matrices.Further, the MDS matrices of the even number rounds and the MDS matrixof the odd number round are arranged in the mutually reverse order, sothat it is ensured that the encrypting process and the decryptionprocess are the same except for a process of changing the order of thekey.

This structure ensures the followings:

(a) the linear conversion matrix of each of the F functions should beMDS,

(b) m arbitrary column vectors of the linear conversion matrix includedin the odd number rounds in the encrypting function are independent, and

(c) m arbitrary column vectors of the linear conversion matrix includedin the even number round are independent.

These (a)-(c) are ensured so as not to generate the simultaneousdifference cancellation because of m or less active S boxes. Therefore,the minimum value of the number of active S boxes of the entireencrypting function increases.

Thus, according to this example of processing, it is possible toincrease the minimum number of the active S boxes in the entireencrypting function, which is the robustness index against thedifferential attack in the common key block encryption. As a result, thenumber of the active S boxes at the time of performing the differentialanalysis (differential attack) increases, and the difficulty of analysisalso increases. Therefore, the highly secure encryption is realized inwhich the key would be difficult to analyze.

SETUP EXAMPLE 2 Linear Conversion Matrix MLTj

As with the Setup Example 1 of the linear conversion matrix MLTj, in theSetup Example 2 of the linear conversion matrix MLTj, corresponding tothe Feistel type common key block encrypting process structure havingthe number of steps (the number of rounds) of 2r, r MDS matrices aregenerated, and all the square matrices applied in the r linearconversion sections of the F functions at the even number rounds are setup as different MDS matrices, and also all the square matrices appliedin the r linear conversion sections of the F functions at the odd numberrounds are set up as different MDS matrices. As a result, similar to theSetup Example 1 of the linear conversion matrix MLTj, it provides theMDS matrices (L1, L2 . . . L6) setup structure as shown in FIG. 9.

As for this Setup Example 2, in an execution sequence of the SetupExample 1 of the linear conversion matrix MLTj as described above withreference to FIG. 10, a method different from the Setup Example 1 isemployed as the MDS matrix generation method in Step S11.

As previously described, the method of generating the MDS matrix in theSetup Example 1 of the linear conversion matrix MLTj is a methodaccording to the processing sequence of FIG. 11. In the Setup Example 2of the linear conversion matrix MLTj, a method (MDS matrix generationmethod 2) according to the processing sequence as shown in FIG. 12 isemployed. The MDS matrix generation method 2 will be described withreference to FIG. 12.

MDS Matrix Generation Method 2

[Step S201]

Input: Assuming that a required number of MDS's is x, expansion order:n, and size of a matrix: m, x pieces of m-th MDS matrices L1, L2, . . ., Lx are generated on GF (2^(n)) at random.

[Step S202]

When m arbitrary columns are taken out from xm columns contained in xpieces of m-th MDS matrices L1, L2, . . . , Lx, they are checked to seewhether they constitute an MDS matrix. If they pass the check, theprocess goes to Step S203, or otherwise returns to Step S201.

In addition, as described above, by MDS matrix, we mean a matrix whichsatisfies the following conditions:

(a) It is a square matrix.

(b) No determinant of any submatrix included in the matrix is zero. Inother words, det(submatrix)≠0

[Step S203]

The x pieces of m-th MDS matrices L1, L2, . . . , Lx are outputted asthe MDS matrices applied to the Feistel type common key block encryptionhaving the number of rounds of 2x.

By way of above processes, x pieces of m-th MDS matrices L1, L2, . . . ,Lx are generated. In this example, x=r.

In the MDS matrix generation processing in the Setup Example 1 of thelinear conversion matrix MLTj, as described in the processing sequenceof FIG. 11, in Step S102 the linear independence is determined whentaking m arbitrary columns from the xm columns contained in x pieces ofm-th MDS matrices L1, L2, . . . , Lx. In the MDS matrix generationprocessing in this Setup Example 2 of the linear conversion matrix MLTj,it is determined whether m arbitrary columns when they are taken outfrom the xm columns contained in x pieces of m-th MDS matrices L1, L2, .. . , Lx that constitute an MDS matrix. In other words, a severer checkis performed.

Similar to the setup example of the MDS matrix in the Setup Example 1 ofthe linear conversion matrix MLTj as previously described, x pieces ofm-th MDS matrices L1, L2, . . . , Lx generated by the MDS matrixgeneration processing in accordance with the processing sequence asshown in this FIG. 12, set Li to the linear conversion matrix MLT_(2i−1)at 2i−1 (1≦i≦r) step, and set MLT_(2r−2i+1) to the linear conversionmatrix MLT_(2i) at 2i (1≦i≦r) step, so that the Feistel type common keyblock encrypting process structure is built with the number of steps(the number of rounds) of 2r.

As a result, as shown in FIG. 9, in the case of 12 steps (r=6), thefollowing steps are set up:

MLT1=L1, MLT2=L6

MLT3=L2, MLT4=L5

MLT5=L3, MLT6=L4

MLT7=L4, MLT8=L3

MLT9=L5, MLT10=L2

MLT11=L6, MLT12=L1.

In other words, also in the Setup Example 2 of the linear conversionmatrix MLTj, corresponding to the Feistel type common key blockencrypting process structure having the number of steps (the number ofrounds) of 2r, r MDS matrices are generated, so that all the squarematrices applied in the r linear conversion sections of the F functionsat the even number rounds are set up as different MDS matrices, and alsoall the square matrices applied in the r linear conversion sections ofthe F functions at the odd number rounds are set up as different MDSmatrices. However, unlike the Setup Example 1 of the linear conversionmatrix MLTj, each of the MDS matrices set up at even steps or odd stepsis ensured to be an MDS matrix, when m arbitrary columns are taken outfrom the xm columns contained in x pieces of m-th MDS matrices L1, L2, .. . , Lx. Further, the MDS matrices at the even number rounds and theMDS matrix of the odd number round are arranged in the mutually reverseorder, so that it is ensured that the encrypting process and thedecryption process are the same except for the process of changing theorder of the key.

This structure ensures the followings:

(a) the linear conversion matrix of each of the F functions is an MDS,

(b) m arbitrary column vectors of the linear conversion matricesincluded in the odd number rounds in the encrypting function are MDSmatrices, and

(c) m arbitrary column vectors of the linear conversion matricesincluded in the even number rounds are MDS matrices.

These (a)-(c) are ensured so as not to generate the simultaneousdifference cancellations because of m or less active S boxes. Further,the following is also ensured:

(d) With the property of MDS, the number of non-zero elements in adifference value obtained due to a (a≦m) pieces of active S boxes ism+1−a or more.

Therefore, the minimum value of the number of active S boxes of theentire encrypting function increases.

Thus, according to this example of processing, it is possible toincrease the minimum number of the active S boxes in the entireencrypting function, which is the robustness index against thedifferential attack in the common key block encryption. As a result, thenumber of the active S boxes at the time of performing differentialanalysis (differential attack) increases, and the difficulty of analysisalso increases. Therefore, the highly secure encryption is realized inwhich the key would be difficult to analyze.

SETUP EXAMPLE 3 Linear Conversion Matrix MLTj

Similar to the Setup Examples 1 and 2 of the linear conversion matrixMLTj, in the Setup Example 3 of the linear conversion matrix MLTj,corresponding to the Feistel type common key block encrypting processstructure having the number of steps (the number of rounds) of 2r, r MDSmatrices are generated, so that all the square matrices applied in the rlinear conversion sections of the F functions at the even number roundsare set up as different MDS matrices, and also all the square matricesapplied in the r linear conversion sections of the F functions at theodd number rounds are set up as different MDS matrices. As a result,similar to the Setup Example 1 of the linear conversion matrix MLTj, itprovides the MDS matrices (L1, L2 . . . L6) setup structure as shown inFIG. 9.

In this Setup Example 2, the method different from those in the SetupExamples 1 and 2 is applied in the execution sequence of the SetupExample 1 of the linear conversion matrix MLTj as described above withreference to FIG. 10, as the generation method of the MDS matrix of StepS11.

In the Setup Example 3 of the linear conversion matrix MLTj, a method(MDS matrix generation method 3) according to the processing sequence asshown in FIG. 13 is applied. The MDS matrix generation method 3 will bedescribed with reference to FIG. 13.

MDS Matrix Generation Method 3

[Step S301]

Input: Assuming that a required number of MDS's is x, expansion order:n, and size of a matrix: m, an xm-th MDS matrix M is generated on GF(2^(n)).

[Step S302]

m rows are arbitrarily selected and extracted from one xm-th MDS matrixM, so that the Matrix M′ of m rows and xm columns is constructed.

[Step S303]

Without overlapping, xm column vectors contained in the matrix M′ of mrows and xm columns are arbitrarily divided into x groups including mcolumn vectors. The m-th square matrices L1, L2, . . . , Lx areoutputted from the column vectors contained in respective groups, as anMDS matrix applied to the Feistel type common key block encryptionhaving the number of rounds 2x.

By way of the above processes, x pieces of m-th MDS matrices L1, L2, . .. , Lx are generated. Further, in this example, x=r.

The MDS matrix generation method 3 will be described more particularlywith reference to FIG. 14.

[Step S301]

An xm-th MDS matrix M is generated on GF (2^(n)). As shown in FIG. 14,the MDS matrix M of xm×xm is generated. In addition, the order of thematrix M generated in this Step S301 may be greater than xm-th.

[Step S302]

As shown in FIG. 14, m rows are arbitrarily selected and extracted fromthe xm-th MDS matrix M, so as to constitute the matrix M′ of m rows andxm columns. In addition, although the example as shown in the figureshows that m consecutive rows are selected and extracted by way ofexample, m separate rows, which constitute the m-th MDS matrix M, mayarbitrarily be selected and extracted so as to constitute the matrix M′of m rows and xm columns.

[Step S303]

Without overlapping, the xm column vectors contained in the matrix M′ ofm rows and xm columns are arbitrarily divided into x groups whichinclude m column vectors. The m-th square matrices L1, L2, . . . , Lxare generated from the column vectors contained in each group.

Similar to the MDS matrix setup examples in the Setup Examples 1, 2 ofthe linear conversion matrix MLTj as previously described, as for xpieces of m-th MDS matrices L1, L2, . . . , Lx generated by the MDSmatrix generation process according to the processing sequence asdescribed with reference to FIG. 13, FIG. 14, Li is set as the linearconversion matrix MLT_(2i−1) at 2i−1 (1≦i≦r) step, and MLT_(2r−2i+1) isset as the linear conversion matrix MLT_(2i) at 2i (1≦i≦r) step, so thatthe Feistel type common key block encrypting process structure havingthe number of steps (the number of rounds) of 2r is built.

As a result, as shown in FIG. 9, in the case of 12 steps (r=6), thefollowing steps are set up:

MLT1=L1, MLT2=L6

MLT3=L2, MLT4=L5

MLT5=L3, MLT6=L4

MLT7=L4, MLT8=L3

MLT9=L5, MLT10=L2

MLT11=L6, MLT12=L1.

In other words, in the Setup Example 3 of the linear conversion matrixMLTj, corresponding to the Feistel type common key block encryptingprocess structure having the number of steps (the number of rounds) of2r, r MDS matrices are generated, so that all the square matricesapplied in the r linear conversion sections of the F functions at theeven number rounds are set up as different MDS matrices, and all thesquare matrices applied in the r linear conversion sections of the Ffunctions at the odd number rounds are also set up as different MDSmatrices. Further, the MDS matrices at the even number rounds and theMDS matrices at the odd number rounds are arranged in the mutuallyreverse order, so that it is ensured that the encrypting process and thedecryption process are the same except for the process of changing theorder of the key.

This structure ensures the following:

(a) the linear conversion matrix of each of the F functions is an MDS,

(b) m arbitrary column vectors of the linear conversion matricesincluded in the odd number rounds in the encrypting function areindependent, and

(c) m arbitrary column vectors of the linear conversion matricesincluded in the even number rounds are independent.

These (a)-(c) are ensured so as not to generate the simultaneousdifference cancellations because of m or less active S boxes.

Further, the following also holds.

(d) from the property of MDS, it is ensured that the number of non-zeroelements in a difference value obtained due to a (a≦m) pieces of activeS boxes is m+1−a or more. Therefore, the minimum value of the number ofactive S boxes of the entire encrypting function increases.

The Setup Example 3 of the linear conversion matrix MLTj especiallyexerts an effect when m and r are large, a time cost concerning matrixdetermination processing (systems 1 and 2) in the processing Examples 1and 2 as described above is considerably high, and it is difficult todetermine a matrix within practical time scale. Even in such a case, theMDS matrix generation method of this processing Example 3 allows thematrix generation process to be attained in a relatively short time.

This is because, in the MDS matrix generation method 3, a system can beapplied which can sufficiently be processed in the practical time scaleeven with respect to the larger numbers of m and r, for example, asystem of generating the generation matrix of the Reed Solomon code.

Also in this Setup Example 3 of the linear conversion matrix MLTj, asdescribed above, it is possible to increase the minimum number of theactive S boxes in the entire encrypting function, which is a robustnessindex against the differential attack in the common key blockencryption. As a result, the number of the active S boxes at the time ofperforming differential analysis (differential attack) increases, andthe difficulty of analysis also increases. Therefore, the highly secureencryption is realized in which the key would be difficult to analyze.

SETUP EXAMPLE 4 Linear Conversion Matrix MLTj

In the Setup Examples 1-3 of the linear conversion matrix MLTj asdescribed above, corresponding to the Feistel type common key blockencrypting process structure having the number of steps (the number ofrounds) of 2r, r MDS matrices are generated, so that all the squarematrices applied in the r linear conversion sections of the F functionsat the even number rounds are set up as different MDS matrices, and allthe square matrices applied in the r linear conversion sections of the Ffunctions at the odd number rounds are also set up as different MDSmatrices. Hereinafter, an example of a structure will be described inwhich, corresponding to the Feistel type common key block encryptingprocess structure having the number of steps (the number of rounds) of2r, q pieces (fewer than r pieces) of MDS matrices are generated so asto achieve an effect similar to that of the Setup Example 1 of thelinear conversion matrix MLTj as described above, that is, the minimumnumber of the active S boxes is increased in the entire encryptingfunction.

An example of a structure which employs this Setup Example is shown inFIG. 15. As an example of a structure in which, the number of steps (thenumber of rounds) is 2r=12, namely, when it is considered as the Feisteltype common key block encrypting process structure where r=6, q=3 orthree types of different MDS matrices are arranged in the Feistel typecommon key block encrypting process structure with the round number of12 steps, FIG. 15 shows MDS matrices (L1, L2, L3) set in the linearconversion sections of the F function sections of respective rounds.

The structure of FIG. 9 is a structure where the plain text of 2 mn bitsis divided into two data P_(L) (Plain-Left) and P_(R) (Plain-Right) ofmn bits, and provided as input values for the F function to be performedat each round. As described above with reference to FIG. 2, any of the Ffunction 401 at first round and the F functions at other round is an Ffunction having the nonlinear conversion section constituted by the Sboxes and the SPN type to which the linear conversion section isconnected.

In the Setup Example of FIG. 15, r=6 and q=3, so that the symbol Ln asshown in each F function indicates an MDS matrix 402. In other words,L1, L2 and L3 respectively indicate three different types of MDSmatrices, and indicate the MDS matrix applied to the linear conversionprocess in the linear conversion section of each F function.

According to this example of processing, a simple structure is realizedwhich is needed in the Setup Examples 1-3 of the linear conversionmatrix MLTj as described above, and which reduces the number of thedifferent MDS matrices.

A processing sequence of the Setup Example 4 of the linear conversionmatrix MLTj will be described with reference to FIG. 16.

[Step S21]

The number q is selected where q is smaller than r which is one half ofthe number of rounds 2r, namely q<r (where q is an integer of two ormore).

[Step S22]

q pieces of m-th MDS matrices L1, L2, . . . , Lq on GF's (2^(n)) aregenerated.

As the generation processing method of the q pieces of m-th MDS matricesL1, L2, . . . , Lq on GF's (2^(n)), the MDS matrix generation method 1(FIG. 11) is employed. In other words, q pieces of m-th MDS matrices L1,L2, . . . , Lq are generated on GF (2^(n)), the linear independence isdetermined when taking m arbitrary columns from qm columns contained inq pieces of the generated m-th MDS matrices L1, L2, . . . , Lq, and theq pieces of m-th MDS matrices L1, L2, . . . , Lq are set in the linearconversion section of the F function section at each round.

In Step S22 when the q pieces of m-th MDS matrices L1, L2, . . . , Lq onGF's (2^(n)) are generated by way of the generation process of the MDSmatrix by employing the MDS matrix generation method 1, then thefollowing MDS matrix setup processes are performed.

[Step S23]

L_((i−1modq)+1) is set as the linear conversion matrix MLT_(2i−1) at2i−1 (1≦i≦r) step.

[Step S24]

MLT_(2r−2i+1) is set as the linear conversion matrix MLT_(2i) at 2i(1≦i≦r) step.

For example, in the example of structure as shown in FIG. 15 or thereare 12 steps (r=6), when q=3, the following steps are set up:

MLT1=L1, MLT2=L3

MLT3=L2, MLT4=L2

MLT5=L3, MLT6=L1

MLT7=L1, MLT8=L3

MLT9=L2, MLT10=L2

MLT11=L3, MLT12=L1

In other words, in the Setup Example 4 of the linear conversion matrixMLTj, corresponding to the Feistel type common key block encryptingprocess structure having the number of steps (the number of rounds) of2r, q (fewer than r) MDS matrices are generated, so that the squarematrices applied in the r linear conversion sections of the F functionat the even number rounds are set up as q different MDS matrices one byone, and the square matrices applied in the r linear conversion sectionsof the F functions at the odd number rounds are also adapted to set up qdifferent MDS matrices one by one. Further, the MDS matrices at the evennumber rounds and the MDS matrices at the odd number rounds are arrangedin the mutually reverse order, so that it is ensured that the encryptingprocess and the decryption process are the same except for the processof changing the order of the key.

This structure ensures the following:

(a) the linear conversion matrix of each F function is an MDS,

(b) m arbitrary column vectors of the linear conversion matricesincluded in at least consecutive q pieces of F functions which are inthe odd number rounds within the encrypting function are independent,and

(c) m arbitrary column vectors of the linear conversion matrix includedin at least consecutive q pieces of F functions in the even numberrounds are independent.

These (a)-(c) are secured, so that as for the Feistel type common keyblock encrypting process structure having the number of rounds of pluralsteps, an effect corresponding to the Setup Example 1 of the linearconversion matrix MLTj as described above can be obtained at consecutive2q−1 rounds.

In other words, at the consecutive 2q−1 rounds, it is ensured that thesimultaneous difference cancellation will not be generated because of mor less active S boxes. Therefore, the minimum value of the number ofactive S boxes of the entire encrypting function increases.

Thus, according to this example of processing, it is possible toincrease the minimum number of the active S boxes in the entireencrypting function, which is the robustness index against thedifferential attack in the common key block encryption. As a result, thenumber of the active S boxes at the time of performing differentialanalysis (differential attack) increases, and the difficulty of analysisalso increases. Therefore, the highly secure encryption is realized inwhich the key would be difficult to analyze.

Further, in this example of processing there is an effect that the typesof matrix required for the encrypting function can be decreased to qtypes, so as to reduce software in code size and hardware in gate scale.

SETUP EXAMPLE 5 Linear Conversion Matrix MLTj

An example of a structure will be described in which, as to the SetupExample 5 of the linear conversion matrix MLTj, similar to the SetupExample 4 of the linear conversion matrix MLTj as described above,corresponding to the Feistel type common key block encrypting processstructure having the number of steps (the number of rounds) of 2r, qpieces (fewer than r pieces) of MDS matrices are generated so as toachieve an effect similar to that of the Setup Example 2 of the linearconversion matrix MLTj as described above, that is, the minimum numberof the active S boxes is increased in the entire encrypting function.

The example of structure which employs this Setup Example is similar tothe Setup Example 4. For example, in the case of r=6 and q=3, the MDSmatrices (L1, L2, L3) are setup as shown in FIG. 15.

This example of processing employs the MDS matrix generation method 2 aspreviously described with reference to FIG. 12, as the generation methodof the MDS matrix of Step S21, in the execution sequence of the SetupExample 4 of the linear conversion matrix MLTj as described withreference to FIG. 16.

In other words, in the Setup Example 4, in the generation of MDSmatrices, the linear independence is determined when taking m arbitrarycolumns from the qm columns contained in the q pieces of m-th MDSmatrices L1, L2, . . . , Lq. In this Setup Example 5 of the linearconversion matrix MLTj, when m arbitrary columns are taken out of the qmcolumns contained in the q pieces of m-th MDS matrices L1, L2, . . . ,Lq, they are checked to see whether they constitute an MDS matrix. Inother words, a severer check is performed so as to generate the q piecesof m-th MDS matrices L1, L2, . . . , Lq.

The q pieces of m-th MDS matrices L1, L2, . . . , Lq generated by theMDS matrix generation processing according to the processing sequence asshown in FIG. 12 are set up by the setup process similar to that of thesetup example of an MDS matrix in the Setup Example 4 of the linearconversion matrix MLTj as previously described. In other words,L_((i−1modq)+1) is set as the linear conversion matrix MLT_(2i−1) at2i−1 (1≦i≦r) step, and MLT_(2r−2i+1) is set as the linear conversionmatrix MLT_(2i) at 2i (1≦i≦r) step.

As a result of this setting processing, for example, in the example ofstructure as shown in FIG. 15, that is, in the case of 12 steps (r=6)and q=3, the following steps are set up:

MLT1=L1, MLT2=L3

MLT3=L2, MLT4=L2

MLT5=L3, MLT6=L1

MLT7=L1, MLT8=L3

MLT9=L2 MLT10=L2

MLT11=L3, MLT12=L1

In other words, similar to the Setup Example 4 of the linear conversionmatrix MLTj, also in the Setup Example 5 of the linear conversion matrixMLTj, corresponding to the Feistel type common key block encryptingprocess structure having the number of steps (the number of rounds) of2r, q (fewer than r) MDS matrices are generated, so that the squarematrices applied in the r linear conversion sections of the F functionat the even number rounds are set up as q different MDS matrices one byone, and the square matrices applied in the r linear conversion sectionsof the F functions at the odd number rounds are also adapted to set up qdifferent MDS matrices one by one. Further, the MDS matrices at the evennumber rounds and the MDS matrices at the odd number rounds are arrangedin the mutually reverse order, so that it is ensured that the encryptingprocess and the decryption process are the same except for the processof changing the order of the key.

This structure ensures the following:

(a) the linear conversion matrix of each F function is an MDS,

(b) m arbitrary column vectors of the linear conversion matricesincluded in at least consecutive q pieces of F functions which are inthe odd number rounds within the encrypting function are MDS matrices,and

(c) m arbitrary column vectors of the linear conversion matrix includedin at least consecutive q pieces of F functions in the even numberrounds are MDS matrices.

These (a)-(c) are secured, so that as for the Feistel type common keyblock encrypting process structure having the number of rounds of pluralsteps, an effect corresponding to the Setup Example 2 of the linearconversion matrix MLTj as described above can be obtained at consecutive2q−1 rounds.

In other words, at the consecutive 2q−1 rounds, it is ensured that thesimultaneous difference cancellation will not be generated because of mor less active S boxes. Further, the following is ensured.

(d) from the property of MDS, the number of non-zero elements in adifference value obtained due to a (a≦m) pieces of active S boxes ism+1−a or more. Therefore, the minimum value of the number of active Sboxes of the entire encrypting function increases.

Thus, according to this example of processing, it is possible toincrease the minimum number of the active S boxes in the entireencrypting function, which is the robustness index against thedifferential attack in the common key block encryption. As a result, thenumber of the active S boxes at the time of performing differentialanalysis (differential attack) increases, and the difficulty of analysisalso increases. Therefore, the highly secure encryption is realized inwhich the key would be difficult to analyze.

Further, in this example of processing there is an effect that the typesof matrix required for the encrypting function can be decreased to qtypes, so as to reduce software in code size and hardware in gate scale.

SETUP EXAMPLE 6 Linear Conversion Matrix MLTj

An example of a structure will be described in which, as to the SetupExample 6 of the linear conversion matrix MLTj, similar to the SetupExamples 4 and 5 of the linear conversion matrix MLTj as describedabove, corresponding to the Feistel type common key block encryptingprocess structure having the number of steps (the number of rounds) of2r, q pieces (fewer than r pieces) of MDS matrices are generated so asto achieve an effect similar to that of the Setup Example 3 of thelinear conversion matrix MLTj as described above, that is, the minimumnumber of the active S boxes is increased in the entire encryptingfunction.

The example of structure which employs this Setup Example is similar tothe Setup Examples 4 and 5. For example, in the case of r=6 and q=3, theMDS matrices (L1, L2, L3) are setup as shown in FIG. 15.

This example of processing employs the MDS matrix generation method 3 aspreviously described with reference to FIG. 13 and FIG. 14, as thegeneration method of the MDS matrix of Step S21, in the executionsequence of the Setup Example 4 of the linear conversion matrix MLTj asdescribed with reference to FIG. 16.

In other words, one qm-th MDS matrix M is generated on GF (2^(n)), and mrows are arbitrarily selected and extracted from one qm-th MDS matrix Mso as to constitute the matrix M′ of m rows and qm columns. Then,without overlapping, the qm column vector contained in the matrix M′ ofm rows and qm columns are arbitrarily divided into q groups which have mcolumn vectors. The m-th square matrices L1, L2, . . . , Lq areoutputted from the column vectors contained in each group, as MDSmatrices to be applied to the Feistel type common key block encryption.

The q pieces of m-th MDS matrices L1, L2, . . . , Lq generated by theMDS matrix generation processing according to the processing sequencesas shown in FIG. 13 and FIG. 14 are set up, similar to the setup exampleof an MDS matrix in the Setup Example 4 of the linear conversion matrixMLTj as previously described. In other words, L_((i−1modq)+1) is set asthe linear conversion matrix MLT_(2i−1) at 2i−1 (1≦i≦r) step, andMLT_(2r−2i+1) is set as the linear conversion matrix MLT_(2i) at 2i(1≦i≦r) step.

As a result of this setting process, for example, in the example ofstructure as shown in FIG. 15, that is, in the case of 12 steps (r=6)and q=3, the following steps are set up:

MLT1=L1, MLT2=L3

MLT3=L2, MLT4=L2

MLT5=L3, MLT6=L1

MLT7=L1, MLT8=L3

MLT9=L2, MLT10=L2

MLT11=L3, MLT12=L1.

In other words, similar to the Setup Examples 4 and 5 of the linearconversion matrix MLTj, also in the Setup Example 6 of the linearconversion matrix MLTj, corresponding to the Feistel type common keyblock encrypting process structure having the number of steps (thenumber of rounds) of 2r, q (fewer than r) MDS matrices are generated, sothat the square matrices applied in the r linear conversion sections ofthe F function at even number rounds are set up as q different MDSmatrices one by one, and the square matrices applied in the r linearconversion sections of the F functions at the odd number rounds are alsoadapted to set up q different MDS matrices one by one. Further, the MDSmatrices at even number rounds and the MDS matrices at the odd numberrounds are arranged in the mutually reverse order, so that it is ensuredthat the encrypting process and the decryption process are the sameexcept for the process of changing the order of the key.

This structure ensures the following:

(a) the linear conversion matrix of each F function is an MDS,

(b) m arbitrary column vectors of the linear conversion matricesincluded in at least consecutive q pieces of F functions which are inthe odd number rounds within the encrypting function are independent,

(c) m arbitrary column vectors of the linear conversion matrix includedin at least consecutive q pieces of F functions in the even numberrounds are independent.

These (a)-(c) are secured, so that as for the Feistel type common keyblock encrypting process structure having the number of rounds of pluralsteps, an effect corresponding to the Setup Example 3 of the linearconversion matrix MLTj as described above can be obtained at consecutive2q−1 rounds.

In other words, at the consecutive 2q−1 rounds, it is ensured that thesimultaneous difference cancellation will not be generated because of mor less active S boxes. Further, the following is also ensured:

(d) from the property of MDS, the number of non-zero elements in adifference value obtained due to a (a≦m) pieces of active S boxes ism+1−a or more at the consecutive rounds 2q−1. Therefore, the minimumvalue of the number of active S boxes of the entire encrypting functionincreases.

Thus, according to this example of processing, it is possible toincrease the minimum number of the active S boxes in the entireencrypting function, which is the robustness index against thedifferential attack in the common key block encryption. As a result, thenumber of the active S boxes at the time of performing differentialanalysis (differential attack) increases, and the difficulty of analysisalso increases. Therefore, the highly secure encryption is realized inwhich the key would be difficult to analyze.

In addition, according to the Setup Example 6 of the linear conversionmatrix MLTj, similar to the Setup Example 3 of the linear conversionmatrix MLTj as previously described, when m and r are large, the timecost concerning the matrix generation methods 1 and 2 is considerablyhigh, and it is difficult to determine a matrix within practical timescale, makes it possible to carry out the matrix generation process in arelatively short time. This is because, as described above, in the MDSmatrix generation method 3, a system such as a system of generating thegeneration matrix of the Reed Solomon code can be applied in such a waythat it can sufficiently perform the process in the practical time scaleeven with respect to the larger numbers of m and r.

Similar to the Setup Examples 4 and 5, in this example of processing,there is an effect that the types of matrix required for the encryptingfunction can be decreased to q types, so as to reduce software in codesize and hardware in gate scale.

Finally, an example of a structure of an IC module 600 as acryptographic processing apparatus which performs encrypting process isshown in FIG. 17. The above-mentioned process can be carried out on aPC, an IC card, a reader/writer, and other various informationprocessing apparatuses, for example. The IC module 600 as shown in FIG.17 can be arranged in these various apparatus.

A CPU (Central processing Unit) 601 as shown in FIG. 17 is a processorwhich starts and terminates encrypting, controls transmission andreception of data, controls data transfer among respective components,and executes other various programs. A memory 602 includes a ROM(Read-Only-Memory) where a program executed by the CPU 601 or a fixeddata as an operation parameter is stored, a RAM (Random Access Memory)used as a storage area or a work area where a program which is executedduring the process by means of the CPU 601 and a parameter which changessuitably in the program processing are stored. Further, the memory 602can be used as a storage area for a key data required for encryptingetc. It is preferable that the storage area for data etc. is constructedas a memory with a tamper resistant structure.

An encrypting section 603 performs encrypting, decoding, etc. accordingto the above-mentioned Feistel type common key block encrypting processalgorithm, for example. In addition, although the example where anencrypting means is an individual module has been shown herein, such anindependent encrypting module may not be provided. For example, anencrypting program may be stored in the ROM, so that the CPU 601 mayread and perform the ROM-stored program.

A random number generator 604 carries out a random number generationprocess which is needed when generating the key needed for encryptingetc.

A transmission/reception section 605 is a data communication processingsection which performs external data communication, for example, carriesout the data communication with an IC module, such as the reader/writeretc so as to output a cipher text generated in the IC module, orperforms data input from an apparatus, such as an externalreader/writer, etc.

With reference to specific examples, the present invention has beendescribed in detail hereinbefore. However, it is obvious that a personskilled in the art can modify and substitute the examples withoutdeparting from the scope of the present invention. In other words, thepresent invention has been disclosed by way of examples, and thedescription of the specification should not be construed as limiting. Inorder to determine the feature of the present invention, the claims asrecited at the front should be considered.

In addition, a series of processes as described in the specification canbe performed by way of hardware, software, or a combination of these.When carrying out a process by way of software, a program havingrecorded a processing sequence can be installed in a memory in acomputer built in a dedicated hardware apparatus, or alternatively it ispossible to make a general purpose computer which can perform variousprocesses install and perform the program.

For example, the program can be recorded beforehand in a hard disk orthe ROM (Read Only Memory) as a recording medium. Alternatively, theprogram can permanently or temporarily be stored (recorded) in aremovable recording medium, such as a flexible disk, a CD-ROM (CompactDisc Read Only Memory), an MO (Magneto optical) disk, a DVD (DigitalVersatile Disc), a magnetic disk, a semiconductor memory, etc. Such aremovable recording medium can be provided as so-called packagedsoftware.

In addition, the program can be installed in a computer through aremovable recording medium as described above, wirelessly transmitted tothe computer from a download site, or transmitted to the computerthrough a wired line or via a network, such as a LAN (Local AreaNetwork), a network called the Internet. The computer can receive thethus transmitted program to be installed in the recording media, such asa built-in hard disk.

In addition, various processes as described in the specification may notonly be performed in chronological order according to the descriptionbut also be carried out in parallel or individually, as needed oraccording to throughput capacity of a apparatus which performs theprocess. Further, in this specification, by a system we mean a logicalgroup structure of a plurality of apparatuses, so that every apparatusis not necessarily provided in the same casing.

As described above, according to the embodiments of the presentinvention, in the Feistel type common key block encrypting process inwhich the SPN type F function having the nonlinear conversion sectionand the linear conversion section is repeatedly executed the pluralityof rounds, the linear conversion process of the F function correspondingto each of the plurality of rounds is performed as the linear conversionprocess which employs the MDS (Maximum Distance Separable) matrix, andthe linear conversion process is carried out which employs the differentMDS matrix at least at each of the consecutive odd number rounds and theconsecutive even number rounds, so that the possibility of occurrence ofsimultaneous difference cancellations caused by an active S box isreduced or removed, whereby it becomes possible to increase the minimumnumber (a robustness index against the differential attack in the commonkey block encryption) of the active S box in the entire encryptingfunction. In other words, the number of the active S boxes at the timeof performing the differential analysis (differential attack) increases,and the difficulty of analyzing an encryption key etc. increases,whereby the robustness against the differential analysis is high andhighly secure encryption processing can be realized. Therefore, it isapplicable to an encryption processing apparatus in which the difficultyof analyzing the key increases and security is required.

It should be understood by those skilled in the art that variousmodifications, combinations, sub-combinations and alterations may occurdepending on design requirements and other factors insofar as they arewithin the scope of the appended claims or the equivalents thereof.

1. A system for performing a Feistel type common key block securityencrypting process, comprising: a processor; and a memory storing aprogram that when executed by the processor: performs, by an SPN type Ffunction, a nonlinear conversion process and a linear conversion processin rounds; performs, by the linear conversion process of the F functioncorresponding to the rounds, a linear conversion process which employs aMaximum Distance Separable (MDS) matrix, and a linear conversion processwhich employs different MDS matrices at consecutive odd number roundsand consecutive even number rounds; performs the Feistel type common keyblock encrypting process for the rounds; performs, by the linearconversion process of the F function corresponding to the rounds, alinear conversion process which employs q (where 2≦q< the number ofrounds) types of different MDS matrices that are repeatedly employed ineven number rounds and odd number rounds; and outputs a result of theconversion.
 2. The system according to claim 1, wherein: the linearconversion section of the F function performs a linear conversionprocess with respect to an input of n bits output by m nonlinearconversion sections and the MDS matrices applied in the linearconversion section of the F function is an MDS matrix, and a matrixhaving m column vectors chosen from the column vectors included in theplurality of MDS matrices is linearly independent.
 3. The systemaccording to claim 1, wherein: the linear conversion section of the Ffunction performs a linear conversion process for an input of n bitsoutput by m nonlinear conversion sections and the MDS matrices appliedin the linear conversion section of the F function are MDS matrices, anda matrix having m column vectors chosen from the column vectors includedin the plurality of MDS matrices is an MDS matrix.
 4. The systemaccording to claim 1, wherein: the MDS matrices applied in the linearconversion section of the F function have a matrix including columnvectors extracted from a matrix M′ and row vectors chosen from an MDSmatrix M, which contains the components included in the different MDSmatrix.
 5. The system according to claim 1, wherein: the different MDSmatrices applied in the linear conversion section of the F function areMDS matrices generated based on a Reed Solomon code generation matrix.6. A cryptographic processing method for performing a Feistel typecommon key block security encrypting process, comprising the steps of:performing, by an SPN type F function, a nonlinear conversion processand a linear conversion process in rounds; performing, by the linearconversion process of the F function corresponding to the rounds, alinear conversion process which employs a Maximum Distance Separable(MDS) matrix, and a linear conversion process which employs differentMDS matrices at consecutive odd number rounds and consecutive evennumber rounds; performing the Feistel type common key block encryptingprocess for the rounds; performing, by the linear conversion process ofthe F function corresponding to the rounds, a linear conversion processwhich employs q (where 2≦q< the number of rounds) types of different MDSmatrices that are repeatedly employed in even number rounds and oddnumber rounds; and outputting a result of the conversion.
 7. Thecryptographic processing method according to claim 6, wherein: thelinear conversion process of the F function performs a linear conversionprocess with respect to an input of n bits output by m nonlinearconversion sections and the different MDS matrices applied in the linearconversion section of the F function is an MDS matrix, and a matrixhaving m column vectors chosen from the column vectors included in theplurality of MDS matrices is linearly independent.
 8. The cryptographicprocessing method according to claim 6, wherein: the linear conversionprocess of the F function performs a linear conversion process for aninput of n bits output by m nonlinear conversion sections and the MDSmatrices applied in the linear conversion section of the F function areMDS matrices, and a matrix having m column vectors chosen from thecolumn vectors included in the plurality of MDS matrices is an MDSmatrix.
 9. The cryptographic processing method according to claim 6,wherein: the MDS matrices applied in the linear conversion section ofthe F function have a matrix including column vectors extracted from amatrix M′ and row vectors chosen from an MDS matrix M, which containsthe components included in the different MDS matrix.
 10. Thecryptographic processing method according to claim 6, wherein: thedifferent MDS matrices applied in the linear conversion section of the Ffunction are MDS matrices generated based on a Reed Solomon codegeneration matrix.
 11. A security encryption processing system,comprising: a processor; and a memory storing a program that whenexecuted by the processor: transforms, by a first encryption processingsection, input information into first nonlinear information and thefirst nonlinear information into first linear information; transforms,by a second encryption processing section, the input information intosecond nonlinear information and the second nonlinear information tosecond linear information; performs an XOR operation based on the firstlinear information and the second linear information; and outputs aresult of the operation, wherein if the first nonlinear information isexpressed as a first sequence vector, the first linear information isexpressed as a second sequence vector, the second nonlinear informationis expressed as a third sequence vector, and the second linearinformation is expressed as a fourth sequence vector, then a firstmatrix indicating transformation from the first sequence vector to thesecond sequence vector is different than a second matrix indicatingtransformation from the third sequence vector to the fourth sequencevector.
 12. The encryption processing system of claim 11 wherein: afirst row vector selected from an inverse matrix of the first matrix anda second row vector selected from an inverse matrix of the second matrixare linearly independent.
 13. The encryption processing system of claim11 wherein: the transformations performed by the first encryptionprocessing section and the second encryption processing section areperformed more than once.
 14. The encryption processing system of claim11 wherein: the first matrix or the second matrix is an MDS matrix. 15.The encryption processing system of claim 11 wherein: the first matrixand the second matrix are MDS matrices.
 16. The encryption processingsystem of claim 11 wherein: the first encryption processing section andthe second encryption processing section receive a common key forencryption.
 17. The encryption processing system of claim 11 wherein: afirst row vector selected from an inverse matrix of the first matrix anda second row vector selected from an inverse matrix of the second matrixare linearly independent.
 18. A security encryption processing methodcomprising the steps of: transforming, by a first encryption processingsection, input information into first nonlinear information and thefirst nonlinear information into first linear information; transforming,by a second encryption processing section, the input information intosecond nonlinear information and the second nonlinear information tosecond linear information; performing an XOR operation based on thefirst linear information and the second linear information; andoutputting a result of the operation; wherein if a the first nonlinearinformation is expressed as a first sequence vector, the first linearinformation is expressed as a second sequence vector, the secondnonlinear information is expressed as a third sequence vector, and thesecond linear information is expressed as a fourth sequence vector, thena first matrix indicating transformation from the first sequence vectorto the second sequence vector is different than a second matrixindicating transformation from the third sequence vector to the fourthsequence vector.
 19. The encryption processing method of claim 18wherein: the transforming steps are performed more than once.
 20. Theencryption processing method of claim 18 wherein: the first matrix orthe second matrix is an MDS matrix.
 21. The encryption processing methodof claim 18 wherein: the first matrix and the second matrix are MDSmatrices.
 22. The encryption processing method of claim 18 furtherincluding: receiving a common key for encryption.